Prevent unapproved, mutable, unverifiable, or critically vulnerable container images from entering the workload environment.
Admit Only Trusted Container Images
CCC.K8S.CN04 · Resource
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP04 | OCI Container Image Execution | The service always accepts OCI-compatible image references and executes their containerized workloads through a Kubernetes-compatible runtime. |
| CCC.K8S.CP05 | Container Registry Integration | The service can authenticate to private or public OCI-compatible registries and retrieve workload images with user-configured identities and credentials. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH04 | Untrusted Container Images are Deployed | Container images whose provenance, integrity, or vulnerability status is not verified may contain unsupported software, altered components, or embedded credentials and be admitted to the cluster. The image is then executed within the workload environment and can expose secrets, alter application data, or disrupt connected services. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN04.AR01 | When a workload is admitted, every container image MUST originate from an approved registry AND be referenced by an immutable digest. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN04.AR02 | When a container image is admitted, its signature and provenance attestation MUST be verified against an approved publisher and build process. | tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN04.AR03 | When a container image contains a known critical vulnerability, admission of that image MUST be denied. | tlp-green, tlp-amber, tlp-red |